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CONTROLS FOR ADVANCED TURBINE ENGINES 


The trend in advanced aircraft turbine engine design is toward more sophisticated 
cycles and mechanical complexity. This is done primarily to achieve improved 
thrust-to-weight ratios and improved specific fuel consumption. Control system 
complexity has also increased due to the increase in the number of engine varia- 
bles which must be scheduled or controlled. Hydromechanical controls are rapidly 
being replaced by full-authority digital electronic controls in order to handle 
the added computational burden. The digital computer, however, does allow more 
sophisticated control algorithms to be used. In this paper, two Lewis Research 
Center sponsored programs will be described which involve the application of ad- 
vanced control techniques to the design of engine control algorithms. Multi- 
variable control theory has been used in the F100 MVCS (multivariable control 
synthesis) program to design controls which coordinate the control inputs for 
improved engine performance, and it presents a systematic method for handling a com- 
plex control design task (fig. 1). Methods of analytical redundancy are aimed at 
increasing the control system's reliability. The F100 DIA (detection, isolation, and 
accommodation) program will be described, which investigates the uses of software 
to replace or augment hardware redundancy for certain critical engine sensors. 


GOALS OF - 

IMPROVED PERFORMANCE AND EFFICIENCY 


LEAD TO - 

INCREASED COMPLEXITY AND DECREASED RELIABILITY 



• MULTIVARIABLE COMTROL THEORY 

- COORDINATE COMTROL VARIABLES FOR IMPROVED PERFORMANCE 

- SYSTEMATIC APPROACH TO COMPLEXITY 


• ANALYTICAL REDUNDANCY 

- SOFTWARE REPLACES HARDWARE REDUNDANCY 

- IMPROVE RELIABILITY WITH RESPECT TO SENSOR FAILURES 
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APPLIED ADVANCED ENGINE CONTROL TECHNIQUES 

The interrelationship of the two programs is depicted in figure 2. Activity in 
applying multivariable control methods to engine controls began in the mid 1970's 
(refs. 1 and 2). Motivated by these early results, a comprehensive program (F100 
MVCS) was begun to demonstrate the benefits of using control theory to design a 
full envelope control for an F100 engine and to verify the design with both simu- 
lated and actual engine testing. Figure 2 shows the NASA LeRC facilities which 
were used in performing the evaluations of the MVC logic. The facilities consist 
of l) a research-type control computer on which the control algorithms are pro- 
grammed, 2) a real-time (hybrid) simulation of the F100 engine, and 3) an altitude 
test cell in which a full-size engine can be run. The F100 DIA program, which is 
now beginning the evaluation phase, built upon early theoretical work (ref. 3) in 
analytical redundancy as applied to flight control systems. The F100 MVCS control 
forms the basis for the control logic used in the DIA program, with sensor fail- 
ure DIA logic being incorporated with it to produce the overall control. As in 
the MVCS program, the DIA logic will utilize the LeRC facilities for overall per- 
formance evaluation. 
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F100 MVCS PROGRAM PARTICIPANTS 


Figure 3 shows the organizations involved in the F100 MVCS program and outlines 
the activities involved in the various phases of the program. The contracted 
portions, funded and monitored jointly by NASA LeRC and the Air Force Wright Aero- 
nautical Laboratories, were carried out by Pratt and Whitney Aircraft (P&WA) and 
Systems Control, Inc. (SCI). The overall program objective was to demonstrate the 
benefits of using linear quadratic regulator (LQR) synthesis procedures in design- 
ing a practical multivariable control system that could operate a turbofan engine 
through its operating envelope. P&WA provided a digital simulation of the F100, a 
set of linear design models, and performance criteria on which the design was 
based. SCI conducted the overall multivariable control design, which was then 
evaluated by P&WA on the digital engine simulation. NASA LeRC programmed the 
control logic on a research control computer and evaluated it using its real-time 
hybrid F100 engine simulation. Upon successful evaluation with the simulation, 

NASA conducted full-scale altitude tests to verify proper operation throughout the 
engine's flight envelope. References 4 to 7 document in detail the complete program 



Figure 3 
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STRUCTURE OF F100 MULTIVARIABLE CONTROL 


The LQR-based control logic was designed to meet the following criteria. Prima- 
rily, the logic must protect the engine against surge and maintain speeds, pres- 
sures, and temperatures below maximum limits. Airframe-engine inlet compatibility 
requires adhering to minimum burner pressure limits and maximum and minimum air- 
flow limits at certain flight conditions. The control must keep thrust and spe- 
cific fuel consumption within tolerance for specified engine degradations. The 
engine must accelerate and decelerate rapidly and repeatably and must remain 
stable in the presence of external disturbances. The basic structure of the F100 
multivariable control logic is shown in figure 4. The five manipulated engine 
inputs are fuel flow, exhaust nozzle area, inlet guide vanes, compressor variable 
geometry, and compressor exit bleed airflow. Primary sensed engine outputs are fan 
speed, compressor speed, main burner pressure, afterburner pressure, and fan tur- 
bine inlet temperature. Basic components of the control are: 1) reference point 
schedules and transition control logic, which produce desired state and output and 
approximate control vectors, 2) gain schedules, which produce feedback matrix 
elements as functions of flight conditions, 3) proportional and integral control 
loops which produce acceptable steady-state and transient engine behavior without 
operating limit exceedance, and 4) engine protect logic that places absolute 
limits on engine inputs to assure safe operation in the test cell despite sensor 
or logic failures. 


u s FEEDFORWARD 
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CONTROL SYSTEM SCHEMATIC FOR ALTITUDE TESTS 


The MVC logic shown in figure 4 was programmed in fixed-point ASSEMBLY language on 
a 16-bit minicomputer and debugged while controlling the LeRC real-time 
hybrid engine simulation. The simulation was a nonlinear, component -level repre- 
sentation of the engine and included lumped-volume and rotor dynamics. It accu- 
rately represents the engine's operation across the entire flight envelope. After 
completion of the hybrid evaluation, the same logic was used to conduct the alti- 
tude test evaluation, as shown in figure 5. Bill of material (BOM) hydromechani- 
cal engine actuators were modified to allow input of electrical commands from the 
minicomputer, and suitable research sensors were provided for feedback signals. 
Portions of the BOM control system were retained to serve as backup control and 
for engine start-up. A complete steady-state and transient evaluation was per- 
formed over the entire flight envelope. The LQR-based control logic performed 
well at all conditions. In addition, the real-time simulation was used periodi- 
cally during the altitude tests for rapidly solving any logic problems encoun- 
tered. The modular interface system between the computer and simulation or engine 
greatly facilitated this mode of operation. 



Figure 5 
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TYPICAL F100 MULTIVARIABLE CONTROL PERFORMANCE IN LARGE PLA TRANSIENT 


Figure 6 shows an F100 engine transient response test performed during the alti- 
tude tests at a simulated altitude of 10,000 feet and Mach number of 0.6. The 
input is a power lever angle step (snap) from 50° to 83° (maximum, non-after- 
burning). This transient caused a number of MVC logic functions to be exercised: 
transfer from fan speed integral control to fan turbine inlet temperature (FTIT) 
limit control, regulator and integral control gains being varied as functions of 
compressor speed, use of the FTIT estimator output, and control of the exhaust 
nozzle area to control fan discharge AP/P, a fan air flow parameter. Initially, 
the control maintains the desired engine operating point by keeping fan speed and 
fan discharge A P/P on desired schedules. During the transient, engine outputs 
generally follow their desired trajectories. Fuel flow is modulated to keep FTIT 
at or near its allowed limit during the initial portion of the transient. At 
steady state, the logic has closed down the nozzle area and trimmed fuel flow so 
that both fan speed and fan discharge AP/P are on schedule. This transient was 
one of over ninety performed using the multivariable control, with inputs being a 
wide variety of PLA trajectories, afterburner ignitions, and flight condition 
excursions. The MVCS program demonstrated that digital engine controls can be 
successfully designed using techniques based on LQR theory. As demands for engine 
performance lead to engine designs which have larger numbers of control variables, 
LQR methods will be increasingly useful for algorithm design. 
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AESOP - INTERACTIVE COMPUTER-AIDED CONTROL SYSTEM DESIGN 

A tool that was developed at Lewis and used during the F100 MVCS program to verify 
and update the contractor's multivariable control designs was the AESOP computer 
program (Algorithms for Estimator and Optimal regulator design). An interactive 
program which solves the LQR and Kalman filter design problems for time invariant 
systems, it is an outgrowth of an earlier batch program LSOCE (ref. 8). As shown 
in figure 7, the user typically accesses AESOP by using a light pen to select 
desired AESOP functions from a menu displayed on a terminal screen. Available 
functions fall into the categories shown: open-loop system analysis (controll- 
ability, observability, eigenvalues, etc.), LQR and Kalman filter design, system 
response to noise inputs (both open- and closed-loop system covariance matrices), 
system transient responses (open and closed loop, for step and initial condition 
inputs), and transfer functions and frequency responses (system poles, zeroes, and 
generation of open- and closed-loop Bode plots) . Graphic output can be produced 
either at the terminal screen or plotted off-line. AESOP also aids the user by 
checking the validity of requested function sequences. A user's manual has been 
prepared (ref. 9). 



Figure 7 
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SENSOR FAILURE DETECTION AND ACCOMMODATION 


The relative immaturity of digital electronics compared to hydromechanical con- 
trols has raised concerns with respect to control system reliability. Past stud- 
ies have shown that the least reliable parts of a digital electronic engine con- 
trol system are the sensors. For this reason, as a follow-on to the F100 MVCS 
program, the F100 DIA program (sensor failure detection, insolation, and accommo- 
dation) was initiated to develop algorithms for enhancing digital control system 
reliability by using analytical redundancy. The general concept of analytical 
redundancy in the context of an engine control system is illustrated in figure 
8 . Assume that the reliability of turbine inlet temperature sensor T 4 is 
insufficient to meet mission-reliability goals. The normal procedure (hardware 
redundancy) would be to add two additional temperature sensors and voting logic 
to determine if and when a sensor has failed. The analytical redundancy 
approach is to incorporate a model of the engine which relates T 4 with other 
sensed engine variables (for example, P 4 and N) . The model is then used to 
generate an estimate of T 4 which can be used with a statistical testing pro- 
cedure to detect and isolate a T 4 sensor failure. Once a failure has been 
detected, the estimate can be used to replace the failed sensor and allow accept- 
able but possibly degraded control performance. In the F100 DIA program, con- 
tractors P&WA and Systems Control Technology (SCT) have: 1) quantified sensor 

failure types and frequency of occurrence, 2 ) determined the relative criticality 
of various failures, and 3) developed a sensor failure DIA algorithm for the F100 
engine (ref. 10 ). 


PRINCIPLE- REPLACE HARDWARE REDUNDANCY WITH ANALYTICAL REDUNDANCY 



HARDWARE REDUNDANCY 

• 3 SENSORS — ^T4 

• MAJORITY VOTE 
DETECTS FAILURE 


ANALYTICAL REDUNDANCY 

• 1 SENSOR — *-T 4 

• REFERENCE MODEL DETECTS 
FAILURE 

• REDUNDANT INFORMATION (P 4 ,N) 
GENERATES T 4 , EST 


Figure 8 
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SENSOR FAILURE DETECTION, ISOLATION, AND ACCOMMODATION CONCEPT 

The structure of the F100 DIA logic and the manner in which it interfaces with the 
MVC logic are shown in figure 9. The two portions of the DIA logic are an on-line 
state estimator and detection and isolation logic. The estimator incorporates an 
accurate, full envelope model of the engine which is updated in real time. Esti- 
mator residuals are continuously monitored by the detection logic, and if a failure 
is detected, isolation and accommodation algorithms are initiated. During normal 
unfailed conditions, an estimate of state x is fed to the LQR gain portion of the 
multivariable control and the integrally controlled engine output variables y are sent 
directly to the integral control portion. This insures that any possible bias in 
the estimate of y will not cause a shift in the desired engine operating point. 

Once a failure has been detected and isolated, the on-line estimator is reconfigu- 
red to exclude the bad sensor, and an estimate of the failed sensor signal is sent to 
the integral control. Due to the modular design of the MVC logic, the only change 
required after addition of the DIA logic was to eliminate the FTIT estimator, a 
task now taken over by the DIA logic. 



Figure 9 
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DIA LOGIC SEQUENCE 


The specific algorithm used by the F100 DIA logic begins with the generation of 
residuals for each of five engine measurements using an estimator which is 
designed to work with all sensors present (fig. 10). Detection and isolation algorithms 
are different, depending on whether a hard (out-of-range), sudden within-range shift) 
or soft (slow drift, slowly increasing noise intensity) failure is being detec- 
ted. A hard failure is detected (and isolated) by simply comparing the sensor 
residual against a threshold. A soft failure is detected by computing the weight- 
ed-sum-squared of all residuals for N past observations and comparing that value 
against a threshold. To isolate a soft failure, a generalized likelihood ratio 
hypothesis test is performed, using residuals computed by a bank of five "off- 
line" estimators, to compute which sensor is most likely to have failed. Each of 
the five off-line estimates has one sensor input left out. The accommodation 
procedure consists of reconfiguring the on-line estimator by changing the gain 
matrix and omitting the bad sensor signal from its input plus resetting of the 
estimator's initial conditions. The F100 DIA logic has been successfully evalu- 
ated on a detailed non— real-time engine simulation while coupled to the MVC 
logic. The logic has been coded for a Lewis-developed microprocessor-based com- 
puter control facility and will subsequently be evaluated while controlling a 
real-time hybrid simulation. 


(1) GENERATE RESIDUALS WITH ON-LINE ESTIMATOR 

(2) DETECT FAILURE 

- HARD : RESIDUAL > THRESHOLD 

- SOFT : WEIGHTED SUM-SQUARED RESIDUALS (WSSR) > THRESHOLD 

(3) ISOLATE FAILURE WrTH GENERALIZED LIKELIHOOD RATIO TESTS 

- HARD : ON-LINE RESIDUAL TEST 

- SOFT : OFF-LINE USING BANK (5) OF ESTIMATORS 

(4) ACCOMMODATE FAILURE 

- RECONFIGURE ON-LINE ESTIMATOR TO EXCLUDE BAD SENSOR 

- REINITIALIZE ESTIMATOR 


Figure 10 


439 


SENSOR FAILURE DIA LOGIC IMPLEMENTATION 


The Lewis computer control facility being used in conjunction with the F100 DIA 
program is based on an Intel 8086 16-bit microprocessor and replaces the minicomputer 
facility used during the F100 MVCS program. It includes both an interface unit 
which allows information interchange between a simulation or an engine and a moni- 
toring unit which displays and records information during a test. Figure 11 shows 
the basic configuration of the facility for implementing the DIA logic. Rapid 
control update requirements led to the use of two microprocessors, one for the 
control logic and one for the DIA logic, which communicate through interrupts and 
transmit data over a multibus. Specialized D/A and A/D allow communication with 
the engine, also through the bus. The timing diagram in figure 11 shows the sub- 
tasks performed by each processor and the inter-processor interrupt timing. The 
MVC processor processes the sensed inputs and sends an interrupt to begin the DIA 
processors's detection algorithm. Both processors then operate in parallel until 
the Kalman filter (estimator) has updated the state estimates, at which time an 
interrupt from the DIA processor allows the estimates to be used by the MVC proc- 
essor in the multivariable control calculations. The DIA processor then searches 
for a possible soft failure, and only if detected, begins the isolation calcula- 
tion, requiring the updating of five additional Kalman filters and the use of the 
GLR algorithm. Languages used in programming the logic were both ASSEMBLY lan- 
guage and FORTRAN with special machine language procedures developed for certain 
time-critical tasks. 
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Figure 11 




FUTURE EFFORTS IN ADVANCED PROPULSION CONTROL 


Advanced control related activities which are or will soon be underway at LeRC are 
outlined in figure 12. The F100 DIA logic will be evaluated on a real-time engine 
simulation throughout the flight envelope and will then be tested in the LeRC 
altitude facility. An operating-point control design will be performed for the 
F100 engine using an alternate frequency-domain method (the multivariable Nyquist 
array) and compared to the existing MVC design. Also, the use of modern robust 
control methodology to design engine controls will be investigated with an eye 
toward decreased sensitivity to modeling errors and simplified control algo- 
rithms. Contracts have just been awarded to investigate how best to incorporate 
robustness into the initial design of sensor failure DIA algorithms. Finally, 
in-house computer-aided control design capability (such as the AESOP program) will 
be enhanced so as to be better able to interactively design and analyze multi- 
variable control and failure detection algorithms for future propulsion systems. 


FUTURE EFFORTS IN ADVANCED PROPULSION CONTROL 

• EXPERIMENTAL EVALUATION OF DIA LOGIC 

• MNA - LQR DESIGN METHOD COMPARISON 

• ROBUST CONTROL DESIGN APPLICATION 

• ROBUST SENSOR DIA LOGIC 

• ENHANCED INTERACTIVE CAD FOR PROPULSION CONTROL 

SYSTEMS 


Figure 12 
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